Researchers at Cato Networks have described a new attack chain used by the cybercriminal group Silver Fox against a Japanese organization in the industrial manufacturing sector. The campaign focuses on abusing weak, legitimate drivers and a DLL-sideloading approach, with the end goal of installing ValleyRAT for persistent remote access.
What makes this attack especially interesting is the combination of multiple techniques that reinforce one another—from phishing lures to defense evasion and robust recovery mechanisms. Below we outline the key components.
Phishing as the starting point for the infection chain
The attack begins with a phishing message in the form of an invoice. Instead of using suspicious servers, the attackers rely on content they control and that is hosted on reputable services, including QQ and Tencent Cloud. This helps make the first step less conspicuous.
Through a ZIP archive, the chain is set in motion, leading to DLL-sideloading. The key detail is that before the malicious payload can be deployed, the attackers use their BYOVD and DLL-sideloading approach to gain kernel access and disrupt security controls on the compromised host.
BYOVD: kernel access with new drivers
In earlier waves, Silver Fox already used BYOVD with known, vulnerable drivers. In this campaign, the attackers deviate and use two additional drivers that, according to the researchers, were previously not publicly associated with similar attacks.
The drivers used are BootRepair.sys and EnPortv.sys, alongside the already seen wsftprm.sys. The malware design combines these components into a modular framework, allowing operators to swap between drivers as they see fit without rebuilding the entire process from scratch.
DLL-sideloading with a “PDF” launcher
The technique that kicks off the next stage centers on a malicious DLL, identified as PDFCORE8.dll, which is sideloaded by a seemingly legitimate executable component: ConvertToPDF.exe or PDFDirect.exe. In that DLL, the previously mentioned drivers are embedded, so the harmful behavior effectively “rides along” with the executable.
According to the researchers, the involved legitimate binaries are tied to Zeon Corporation. Such connections are often used to raise the bar for detection: after all, it’s not completely unknown software, but something that could appear trustworthy on its own.
NTDLL unhooking to evade detection
In addition to injecting and loading components, the malware also tries to hide. A notable element is NTDLL unhooking: the malware attempts to remove user-mode inline hooks placed by endpoint security, making it harder to observe native Windows API activity.
Persistent execution with a dual watchdog design
After the chain is started, a downloader is deployed to fetch the next stages. These components are obtained from an attacker infrastructure hosted on Tencent Cloud. From within the described chain, a loader-like component is then used, which also handles further persistence mechanisms.
The most resilient feature of the campaign is the dual watchdog. There is an internal routine that monitors the injected payload portion, as well as an external watchdog batch script that—via a scheduled task—checks whether the loader component is still active.
Practically, that means: if one component stops, the other can restore the process. If the injected payload is terminated, it is recreated by the loader. If the loader is disabled, the watchdog script steps in to resume execution.
ValleyRAT as the endpoint for remote access
Ultimately, the chain results in the installation of ValleyRAT, a variant of Gh0st RAT. The researchers associate ValleyRAT with capabilities such as command-and-control (C2) communication and task execution, along with additional options after compromise.
To activate the final phase, shellcode is downloaded from an external server and then injected into a new process named svchost.exe. This uses a technique referred to as thread-context hijacking, which helps conceal the malicious behavior within a process that may otherwise look normal.
What this says about Silver Fox’s strategy
The researchers place the finding within a broader trend: Silver Fox continues refining and expanding its toolkit. Besides ValleyRAT, they also mention other malware and loader components, such as Atlas RAT (AtlasCross RAT), RomulusLoader, and SilentRunLoader.
They also point to earlier patterns where tax-related lures were used to deliver other RAT variants. In addition, there’s reference to a separate retrohunt by a South Korean party: based on VirusTotal data, it found many different samples of Atlas RAT, with the scale and variation not easily explained as the work of a single operator. At the same time, they note that a firm link to Silver Fox has not been definitively established.
Why defenders should pay attention
The combination of BYOVD and DLL-sideloading, together with unhooking and a dual watchdog recovery architecture, makes this campaign demanding for detection and response. Stopping the payload alone isn’t enough—the recovery mechanisms can rebuild the infection.
For organizations in the industrial manufacturing sector, this means controls must go beyond blocking a single component. In particular, integrity monitoring, logging around scheduled tasks, and analyzing suspicious DLL loading can help break the chain early.
In short, this campaign shows how Silver Fox layers multiple techniques to gain access, evade detection, and maintain a durable presence on systems.
Source: https://thehackernews.com/2026/07/silverfox-targets-japanese-manufacturer.html
